How to Log In with Passkeys on Telegram: Cross-Device QR Auth, Instant Biometrics & Recovery
Once a passkey exists, signing in stops involving a code. On a new phone you enter your number and confirm with your face or fingerprint; on a computer you scan the code the screen is showing with the phone that holds the key.
Which is faster, works without a signal, and raises one question worth answering carefully: you have been told your whole life not to scan login codes.
What you will be able to do
- check_circle Sign in on a new phone without waiting for a code.
- check_circle Use a passkey on desktop and on the web.
- check_circle Tell a safe code from a dangerous one.
- check_circle Know what to do when it is not offered.
No code arrives and none is typed — the device you already trust does the confirming.
qr_code_scanner The rule about codes has not changed
Scanning a code to sign in sounds exactly like the thing that gets accounts stolen, and it is worth being precise about why it is not. The dangerous version is scanning a code that somebody else produced: their computer asks to log in, you scan it, and the session that opens belongs to them on your account.
The safe version has three properties at once. You opened the screen showing the code. You did it just now, because you wanted to sign in. And the code is on a device in front of you rather than in a message, a photograph, or on somebody's laptop.
That is the whole test and it survives every version of the trick. A helpful person with a code for you to scan, a code sent to check something, a code on a screen at a stall — none of those pass it, whether or not passkeys are involved.
What happens on a new phone?
You install the app and enter your number as usual, and instead of waiting for a code you choose the passkey option and confirm with whatever unlocks that device. The key comes from the credential manager you are signed into on that phone, so this works on a handset you have never used with this account before — provided it is signed into your platform account.
And on a computer?
The desktop app and the web client show a code and you scan it with the phone holding your passkey. It is the same handshake that has always existed for signing in on a computer, with the confirmation on the phone being a passkey rather than a tap. If you have a hardware key plugged into the computer itself, that can stand in for the phone.
Why is it not offering me the passkey option?
Almost always because the device cannot reach your key: a different platform account on that phone, a browser whose stored data was cleared, a work laptop signed into something else. Nothing is broken and nothing is lost — the code route is still there, and once you are in you can register a passkey on this device too.
Do I still get asked for my cloud password?
Expect to. Two-step verification is a separate layer from how you proved the account is yours, so a passkey login can still be followed by the password prompt. That is the system working as intended rather than a sign that the passkey failed, and it is the reason to keep that password somewhere you can actually retrieve it.
Is this useful when travelling?
It is one of the clearest wins. Signing in the old way needs a message to reach the number, which is exactly what stops working with a foreign SIM in the phone, a number left at home, or no signal at all. A passkey needs neither the number nor a message — only the device and an internet connection.
Can I use it on somebody else's computer?
You can, and the convenience is exactly what makes it worth thinking about. Signing in creates a session on that machine that continues after you walk away, regardless of how you authenticated. The web client in a private window is the better choice on a borrowed computer, and ending the session deliberately afterwards matters more than how you started it.
devices What a sign-in actually creates
However you do it, the result is a session: a device that now has your whole history and stays signed in until somebody ends it. Passkeys make creating one easier, which is worth pairing with the habit of occasionally reading the list.
Open the device list after any unusual login — a new computer, a borrowed machine, anything abroad — and look for entries you cannot place. Anything unfamiliar can be ended from there, immediately, and ending a session takes effect on that device rather than asking it politely.
It is also the place where the old attack would show up. If a login code ever arrives that you did not ask for, somebody is trying the code route on your number; the correct response is to ignore the message entirely and check that list.
settings Signing in
- Enter your number as usual Then choose the passkey option.
- Confirm with the device unlock No code arrives.
- On a computer, scan the code your screen shows With the phone holding the key.
- Never scan one somebody shows you That is the old attack, unchanged.
- Expect the cloud password It is a separate layer.
- Check the device list afterwards And end anything you do not recognise.
This page opens a session. The curriculum step is the list of them: what each entry means, how to read one you do not recognise, and what ending it does to the device on the other end.
Logging in with a passkey at a glance
The three properties that make a code safe to scan, what happens on a new phone and on a computer, why the option sometimes does not appear, and the session check afterwards, on one page. Tap to open it at full resolution.
![[Telegram Tips & Shorts] How to Instant Log In with QR Codes on Telegram Desktop & Web: Complete Multi-Device Guide](https://tgway.com/images/guides/video_poster_137.webp)